CoreCVE
Back

HIGH

Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

Published Nov 18, 2020

Description

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

Affected products

Remediation

Red Hat statement

While OpenShift Container Platform (OCP), Red Hat OpenShift Jaeger (RHOSJ), OpenShift Service Mesh (OSSM), and OpenShift Virtualization all contain RPMs and containers which are compiled with a vulnerable version of Go, the vulnerability is specific to the building of Go code itself. Using `go get` or `go build` and as such, the relevant components have been marked as not affected. Additionally, only the main RPMs and containers for OCP, RHOSJ, OSSM, and OpenShift Virtualization are represented due to the large volume of not affected components. Red Hat Ceph Storage 3 ships the vulnerable version of go, and an attacker building go code on RHCS 3 could potentially exploit this vulnerability.

Red Hat mitigation

If it's possible to confirm that the Go project being built does not rely on any cgo code in the included dependencies, the env variable CGO_ENABLED=0 can be specified when using either `go get` or `go build`. For example: CGO_ENABLED=0 go get github.com/someproject This will not stop the files being downloaded but will stop any automatic complication of the cgo code, including inlined in the go file and separate .c files. Of course, this will only be effective if cgo is not relied upon in a given dependency and may not be appropriate in all scenarios.

Metrics

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-94

Code Injection

References (10)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Go
Published Nov 18, 2020
Updated Aug 4, 2024
Reserved Nov 9, 2020
Link CVE-2020-28366
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2020-28366
Red Hat
Severity Moderate
Public date Nov 12, 2020
Links CVE-2020-28366 - Bugzilla